{"schema_version":"1.7.3","id":"SUSE-SU-2018:0862-1","published":"2018-04-03T15:16:58Z","modified":"2026-02-04T02:15:34.532486Z","related":["CVE-2012-6706","CVE-2017-12938","CVE-2017-12940","CVE-2017-12941","CVE-2017-12942"],"upstream":["CVE-2012-6706","CVE-2017-12938","CVE-2017-12940","CVE-2017-12941","CVE-2017-12942"],"summary":"Security update for unrar","details":"This update for unrar to version 5.6.1 fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-12938: Prevent remote attackers to bypass a directory-traversal\n  protection mechanism via vectors involving a symlink to the . directory, a\n  symlink to the .. directory, and a regular file (bsc#1054038).\n- CVE-2017-12940: Prevent out-of-bounds read in the EncodeFileName::Decode call\n  within the Archive::ReadHeader15 function (bsc#1054038).\n- CVE-2017-12941: Prevent an out-of-bounds read in the Unpack::Unpack20\n  function (bsc#1054038).\n- CVE-2017-12942: Prevent a buffer overflow in the Unpack::LongLZ function\n  (bsc#1054038).\n\nThese non-security issues were fixed:\n\n- Added extraction support for .LZ archives created by Lzip compressor\n- Enable unpacking of files in ZIP archives compressed with XZ algorithm and\n  encrypted with AES\n- Added support for PAX extended headers inside of TAR archive\n- If RAR recovery volumes (.rev files) are present in the same folder as usual\n  RAR volumes, archive test command verifies .rev contents after completing\n  testing .rar files\n- By default unrar skips symbolic links with absolute paths in link target when\n  extracting unless -ola command line switch is specified\n- Added support for AES-NI CPU instructions \n- Support for a new RAR 5.0 archiving format\n- Wildcard exclusion mask for folders\n- Added libunrar* and libunrar*-devel subpackages (bsc#513804)\n- Prevent conditional jumps depending on uninitialised values (bsc#1046882)\n","affected":[{"package":{"name":"unrar","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-5.3.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-5.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:0862-1.json"}},{"package":{"name":"unrar","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","purl":"pkg:rpm/suse/unrar&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-5.3.1"}]}],"ecosystem_specific":{"binaries":[{"unrar":"5.6.1-5.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:0862-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180862-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1046882"},{"type":"REPORT","url":"https://bugzilla.suse.com/1054038"},{"type":"REPORT","url":"https://bugzilla.suse.com/513804"},{"type":"REPORT","url":"https://bugzilla.suse.com/693890"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2012-6706"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12938"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12940"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12941"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-12942"}]}